Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,683 total · sorted newest first- Oct 20, 2026
Malicious code in memories-core-web (npm)
1 compromised version
- Oct 20, 2026
Malicious code in rootaccessxvv-bbmarker (npm)
1 compromised version
- Oct 20, 2026
Malicious code in @securihackbot/depconf-stage-1792484738 (npm)
1 compromised version
- Oct 20, 2026
Malicious code in hijok-lampam (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in trijigo-kalip (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in jiklpo-tsunari-kay (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in hijiko-pilaka (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in facewareretargeter (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in @securihackbot/depconf-stage-1792484738 (npm)
1 compromised version
- Oct 20, 2026
Malicious code in rs-lookout-sandbox-poc (npm)
1 compromised version
- Oct 20, 2026
Malicious code in memories-core-web (npm)
1 compromised version
- Oct 20, 2026
Malicious code in semveer (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semmver (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semverr (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in security-research-startup-snapshot-810764b303 (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semvver (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in research-probe-6150c1c915 (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semvver (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semveer (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semmver (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in semverr (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in nwfp-build-config (npm)
2 compromised versions
- Oct 20, 2026
Malware in nwfp-build-config
1 compromised version
- Oct 20, 2026
Malicious code in unicode-title-normalizer (npm)
1 compromised version
- Oct 20, 2026
Malicious code in formatting-subtitles-for-claude (npm)
2 compromised versions
- Oct 20, 2026
Malware in formatting-subtitles-for-claude
1 compromised version
- Oct 20, 2026
Malware in unicode-title-normalizer
1 compromised version
- Oct 20, 2026
Malicious code in security-research-startup-snapshot-810764b303 (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in research-probe-6150c1c915 (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in workalender (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in workcalender (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in test-workalendar-internal (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in pafex (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in resion (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in workalender (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in pafex (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in resion (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in workcalender (PyPI)
1 compromised version
- Oct 20, 2026
Malicious code in test-workalendar-internal (PyPI)
3 compromised versions
- Oct 20, 2026
Malicious code in @platform-services/hrm-mfe-core (npm)
1 compromised version
- Oct 20, 2026
Malicious code in @platform-services/hrm-mfe-core (npm)
1 compromised version
- Oct 20, 2026
Malicious code in sc-announcer (npm)
1 compromised version
- Oct 20, 2026
Malicious code in fanarena-common (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-visual-kit (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-motionanimate (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-fabric (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-animatemotion (npm)
1 compromised version
- Oct 20, 2026
Malicious code in sc-wizard (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwind-keyframes (npm)
1 compromised version
- Oct 20, 2026
Malicious code in tailwindcss-keyframe-kit (npm)
1 compromised version
Page 12 of 7,294